© foley & lardner 2001 when printing in black & white: go to the title master slide, delete...

© FOLEY & LARDNER 2001

Organized Health Care Arrangement or Affiliated Covered Entity: Analysis of

Potential Benefits and Hidden Pitfalls by Integrated Delivery System

Robyn A. Meinhardt, RN, JD

Foley Lardner, Denver

HIPAA Summit West II

March 15, 2002

San Francisco

2


Organizational Options

Not optional: Covered Entity status (health plans, health care providers, clearinghouses -- includes “hybrid” covered entities)

Optional:

– “Organized Health Care Arrangements” (OHCAs)

– “Affiliated Covered Entity[ies]” (ACEs)

3


Case Study: OHCA/ACE Choices in an Integrated Delivery Setting

The Hypothetical Setting:

– An integrated delivery system comprised of several types of health care providers (several hospitals and their outpatient clinics; physician offices; employed physicians; a dialysis clinic that is a joint venture between a hospital and a physician group, and a nursing home) and a health plan.

– Each of these components is within the same state, and they are fairly evenly distributed between rural and urban settings.

4


What Problems Could Be Addressed? Multiple Consents:

– each hospital, physician, other provider must obtain its own HIPAA Consent from the patient before using or disclosing PHI (protected health information).

Lack of opportunity to obtain Consent

– Ambulance services problem

– Transfer of emergency patients from rural to tertiary before Consent obtained

5


What Problems Could Be Addressed? con’t IDS entities want to continue/increase sharing

PHI for common operational purposes including but not limited to QA, UR, shared financial risk

– With HIPAA Consent, may use/disclose PHI to provide treatment, to obtain payment for services, and to accomplish “health care operations”

– Both the OHCA and the ACE would allow sharing of PHI across participating entity lines for treatment, payment, operations purposes

6


Health Care Operations: QA/QI

peer review

health care professional training,

accreditation,

licensing,

credentialing,

medical reviews, legal and auditing services

compliance programs

business planning and development (including formulary development)

business management

general administrative activities, including:

– HIPAA compliance,

– customer service,

– grievance resolution,

– due diligence in connection with asset sales, and

– certain marketing and fundraising activities.)

7


What Problems Could Be Addressed? con’t

IDS entities use common vendors for IT, audit, legal, patient satisfaction surveys, others; they don’t want to negotiate the revision of these separately (to add Business Associate terms and to otherwise revise/renew from time to time)

A couple of the IDS entities provide Business Associate-type services to the other IDS entities (peer review consulting/medical review and assistance with accreditation preparations)

8


What Problems Could Be Addressed? con’t Desire for greater control over HIPAA

compliance in the IDS setting– Because under an OHCA or an ACE PHI

may be shared across entity lines for treatment, payment and health care operations activities, a centralized HIPAA office could have access to PHI as needed to evaluate compliance and discuss problems with others in different locations.

9


What Problems Could Be Addressed? con’t The hospitals, outpatient clinics,

employed physicians, the joint ventured dialysis clinic and the health plan share a set of databases that include operational, financial and protected health information. These databases are used for treatment, payment and health care operations functions.

10


What Fits? Different Qualifications for OHCAs and ACEs ACE participants must be under common

ownership or control– Common ownership: another entity holds at least

a 5% interest in all participating entities– Common control: when another entity holds the

power, directly or indirectly, to significantly influence or direct the actions or policies of another entity.

In this IDS, all entities except non-employed medical staff members are under common control

11


Different Qualifications between OHCAs and ACEs For the OHCA option, this IDS must fit

within one of 2 (of the 5) types of OHCAs:– (1) a clinically integrated setting, or– (2) entities hold themselves out to public as

participating in a joint arrangement, and participate in joint activities, including at least one of:

UR, QA&I, or joint payment activities involving shared financial risk.

12


Benefits Common to Each Option

– May share PHI across participating entity lines, for treatment/payment/operations purposes

– Participants are exempt from having Business Associate agreements with each other (for services contracts that involve PHI disclosure)

13


Benefits Common to Each Option, con’t

May use a Joint Consent IF a Joint Notice also used

– Helps to ease consent burden among participating covered entities

May be difficult to agree on Joint Notice -- especially if more than one state involved

May have one Business Associate agreement with a common vendor to participants

14


Differences in Options In ACE arrangements, all participants constitute one covered

entity:

– May have only one privacy officer, if desired

– MUST use a Joint Notice (but note difficulty -- not impossibility -- with multiple state laws that are contrary to and more stringent than HIPAA)

– Requests for accounting, access or amendment apply to all participants

– **Cannot share PHI between provider and plan participants unless patient receives services from both

15


Differences in Options, con’t This is the “504(g)(2) problem” that ACE

arrangements involving both providers and plans have

– can’t intermingle database of PHI unless patient involved in both the payor and the provider services

In OHCA arrangements, justification for sharing PHI across participants must be documented, but there is no prohibition of HCP/HP sharing

16


Differences in Options, con’t Our hypothetical IDS chooses the OHCA option

in order to avoid the 504(g)(2) problem; what OHCA-specific problems does it now have?

– Who should participate in the OHCA?

Employed physicians are workforce; what about other Medical Staff members -- and their practice partners? call partners? allied health practitioners? physicians they refer to? Ambulance service providers? etc.

How to communicate participating/nonparticipating Medical Staff members in Notice and Consent?

17


Differences in Options, con’t

– Potentially overlapping circles of OHCAs

What if the non-employed physicians participate in more than one OHCA? should consider either using a Common Notice of Privacy Practices across all circles, versus keeping databases segregated and identified to the Notice that applies to it.

– Not clear whether, in the “clinical integration” OHCA model, whether PHI may be shared only for the integrated activities.

– Must document rules and basis for sharing PHI across entity lines

18


Both Options: Potential Problems/Issues:

– The degree to which either option increases “joint and several” liability risks

HIPAA declares that participants in ACE are each liable for their own HIPAA compliance -- but this does not affect lawsuits, etc.

– If Joint Consent is the impetus, consider whether agreement can be reached on Joint Notice

19


Both Options: Potential Problems/Issues, con’t

– Does more stringent state law on consent/authorization mandate permission every time a disclosure is made to a separate legal entity?

– What will OHCA or ACE status actually have on “outside” relationships?

Not a legal entity, unless action taken to make it so

Can the OHCA enter into contracts on behalf of participants?

– Method of oversight of participants and of termination

20


Both Options: Potential Problems/Issues, con’t

– HIPAA does not provide antitrust immunity for either OHCA or ACE options: what is the risk?

For sharing PHI for operations purposes

For sharing PHI for payment (i.e., financial) purposes

Of selecting some but not all competitors to participate in OHCA

– (not our fact situation, but would have excluded non-employed physicians if ACE had been chosen)

21


Both Options: Potential Problems/Issues, con’t How best to document the designation

and rights/responsibilities of the participating entites

– HIPAA does not define

– State law may impact

– Probably should include board resolutions, contract, various policies and procedures, Consent and Notice forms as applicable, etc.

22


Both Options: Potential Problems/Issues, con’t Documentation should include

agreements as to:

– Administrative authority for the arrangement -- who’s in charge

– Assignment of formal contracting authority, as applicable, and any limits on that authority

– How to manage/communicate changes in privacy practices that could affect a Joint Notice

23


Both Options: Potential Problems/Issues, con’t– How to communicate receipt and revocation of a Joint

Consent

– How to minimize related liability (indemnity, insurance, compliance audits, other)

– Removal/withdrawal of participants -- reasons and methods

– Method of and reasons for termination of the arrangement

– Effects of removal/withdrawal/termination on shared PHI going forward


Questions?

Robyn A. Meinhardt, RN, JDFoley Lardner1999 Broadway, Suite 2270Denver, Colorado [email protected]

© foley & lardner 2001 when printing in black & white: go to the title master slide, delete...

Documents